AWS Security Agent: On-Demand Security Validation via Context-Aware Multi-Stage Penetration Testing

Traditional outsourced penetration tests conducted once or twice a year cannot keep up with security changes in applications deployed daily. AWS Security Agent addresses this structural limitation by pre-analyzing source code and documentation to deeply understand the application before automatically executing multi-stage attack chains. It specifically applies a proof-based approach that demonstrates discovered vulnerabilities as actual exploits to filter out false positives, reporting reproducible attack paths alongside fix PRs.

Four Features of Security Agent

Security Agent provides four features across the entire development lifecycle.

• Design Security Review: Provides feedback before code is written by comparing design documents against organizational security requirements (GA).
• Threat Modeling: Generates STRIDE-based threat models and supports re-runnable configurations (Preview).
• Code Security Review: Performs full repository scans and automated analysis at the PR level (Preview).
• Penetration Testing: Supports context-aware multi-stage penetration testing and fix PR generation (GA).

On-Demand Penetration Testing Workflow

Penetration testing is executed via Agent Space and includes safeguards to verify ownership of the target domain. By connecting source code providers (such as GitHub, GitLab) and documentation providers (Confluence), it enables context-aware testing that scanners cannot mimic. Since AWS Continuum, announced in June 2026, offers the same functionality, both names may appear together in AWS materials.